Varnish and "arbitrary VCL"

There's nothing wrong with it, is just not as flexible as editing the file by hand.

I don't know how can that cookie be there, this line removes everything except the Zope/Plone related cookies:

    set req.http.Cookie = regsuball(req.http.Cookie, ";(__ac|__cp|_ZopeId|statusmessages)=", "; \1=");